DFNS SDKs connect to the DFNS API over TLS and trust the certificate authorities (CAs) of the runtime they run on: Node.js, Python certifi, Go, the JDK, or the operating system. When a CA is compromised, your application stays exposed until that runtime is updated. Updating the DFNS SDK alone is not enough.
On October 17th, 2026, eight eMudhra intermediate CA certificates were disclosed with private keys that anyone can recover. With those keys, an attacker can issue a certificate for any domain, including api.dfns.io, that your runtime accepts as valid. An attacker on the network path between your application and DFNS could then read or change your traffic.
Browsers already block these certificates. Server runtimes and command-line tools do not check revocation by default, so they accept them until their trust store is updated.
Update the runtime of every application that calls the DFNS API:
Last modified on October 26, 2026
